Java is 'unable to find valid certification', although TrustStore contains root certificate

Question

I'm trying to send an HttpRequest to "https://api.ecs.echa.europa.eu" using

HttpRequest request = HttpRequest.newBuilder()
                .uri(URI.create("https://api.ecs.echa.europa.eu"))
                .GET()
                .build();
HttpClient httpClient = HttpClient.newBuilder().version(HttpClient.Version.HTTP_1_1).build();
HttpResponse<String> response = httpClient.send(request, HttpResponse.BodyHandlers.ofString());

Executing this code I get javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Now I already found a solution to this problem by adding the certificate to my java truststore under $JAVA_HOME/jre/lib/security/cacerts

What I still don't understand, is why this is necessary:

The specific website (https://api.ecs.echa.europa.eu) uses the root certificate DigiCert Global Root CA, which is already contained in the java truststore. Why is that not enough?

Sending requests to other websites that use this root certificate does work...

Thanks for your help :)

If you're using an application container then adding to $JAVA_HOME/jre/lib/security/cacerts won't help. you have to add it to the certs that the app container is using. — Sagar Nair, Feb 11 '20 at 16:48
I'm using Java 13.0.1. Adding to cacerts does help but I want to know why it is necesarry — elefant1000, Feb 11 '20 at 16:52

Jorge Duarte · Accepted Answer · 2020-02-11T19:10:28.993

0

The reason why this error happens (probably) is because of a misconfigured server. You can check here: https://whatsmychaincert.com/?api.ecs.echa.europa.eu

This site will tell you if your server cert chain is properly configured, which doesn't seem so.

Also, you are able generate the full cert chain on the same site using your public key.

Try to fix this and test again.

edited Feb 11 '20 at 19:10

answered Feb 11 '20 at 17:34

Jorge Duarte

126
7

Thanks, that makes sense. Unfortionally it's a server operated by an european authority so I can't do anything about it, but now I at least know where this (probably) comes from – elefant1000 Feb 11 '20 at 22:37

Java is 'unable to find valid certification', although TrustStore contains root certificate

1 Answers1